Generic Security Service Application Program Interface Version 2, Update 1
RFC 2743

Network Working Group                                            J. Linn
Request for Comments: 2743                              RSA Laboratories
Obsoletes: 2078                                             January 2000
Category: Standards Track

         Generic Security Service Application Program Interface
                          Version 2, Update 1

Status of this Memo

   This document specifies an Internet standards track protocol for the
   Internet community, and requests discussion and suggestions for
   improvements.  Please refer to the current edition of the "Internet
   Official Protocol Standards" (STD 1) for the standardization state
   and status of this protocol.  Distribution of this memo is unlimited.

Copyright Notice

   Copyright (C) The Internet Society (2000).  All Rights Reserved.

Abstract

   The Generic Security Service Application Program Interface (GSS-API),
   Version 2, as defined in [RFC-2078], provides security services to
   callers in a generic fashion, supportable with a range of underlying
   mechanisms and technologies and hence allowing source-level
   portability of applications to different environments. This
   specification defines GSS-API services and primitives at a level
   independent of underlying mechanism and programming language
   environment, and is to be complemented by other, related
   specifications:

      documents defining specific parameter bindings for particular
      language environments

      documents defining token formats, protocols, and procedures to be
      implemented in order to realize GSS-API services atop particular
      security mechanisms

   This memo obsoletes [RFC-2078], making specific, incremental changes
   in response to implementation experience and liaison requests. It is
   intended, therefore, that this memo or a successor version thereto
   will become the basis for subsequent progression of the GSS-API
   specification on the standards track.

Linn                        Standards Track                     [Page 1]
RFC 2743                        GSS-API                     January 2000

TABLE OF CONTENTS

   1: GSS-API Characteristics and Concepts . . . . . . . . . . . .  4
   1.1: GSS-API Constructs . . . . . . . . . . . . . . . . . . . .  6
   1.1.1:  Credentials . . . . . . . . . . . . . . . . . . . . . .  6
   1.1.1.1: Credential Constructs and Concepts . . . . . . . . . .  6
   1.1.1.2: Credential Management  . . . . . . . . . . . . . . . .  7
   1.1.1.3: Default Credential Resolution  . . . . . . . . . . . .  8
   1.1.2: Tokens . . . . . . . . . . . . . . . . . . . . . . . . .  9
   1.1.3:  Security Contexts . . . . . . . . . . . . . . . . . . . 11
   1.1.4:  Mechanism Types . . . . . . . . . . . . . . . . . . . . 12
   1.1.5:  Naming  . . . . . . . . . . . . . . . . . . . . . . . . 13
   1.1.6:  Channel Bindings  . . . . . . . . . . . . . . . . . . . 16
   1.2:  GSS-API Features and Issues . . . . . . . . . . . . . . . 17
   1.2.1:  Status Reporting  and Optional Service Support  . . . . 17
   1.2.1.1: Status Reporting . . . . . . . . . . . . . . . . . . . 17
   1.2.1.2: Optional Service Support . . . . . . . . . . . . . . . 19
   1.2.2: Per-Message Security Service Availability  . . . . . . . 20
   1.2.3: Per-Message Replay Detection and Sequencing  . . . . . . 21
   1.2.4:  Quality of Protection . . . . . . . . . . . . . . . . . 24
   1.2.5: Anonymity Support  . . . . . . . . . . . . . . . . . . . 25
   1.2.6: Initialization . . . . . . . . . . . . . . . . . . . . . 25
   1.2.7: Per-Message Protection During Context Establishment  . . 26
   1.2.8: Implementation Robustness  . . . . . . . . . . . . . . . 27
   1.2.9: Delegation . . . . . . . . . . . . . . . . . . . . . . . 28
   1.2.10: Interprocess Context Transfer . . . . . . . . . . . . . 28
   2:  Interface Descriptions  . . . . . . . . . . . . . . . . . . 29
   2.1:  Credential management calls . . . . . . . . . . . . . . . 31
   2.1.1:  GSS_Acquire_cred call . . . . . . . . . . . . . . . . . 31
   2.1.2:  GSS_Release_cred call . . . . . . . . . . . . . . . . . 34
   2.1.3:  GSS_Inquire_cred call . . . . . . . . . . . . . . . . . 35
   2.1.4:  GSS_Add_cred call . . . . . . . . . . . . . . . . . . . 37
   2.1.5:  GSS_Inquire_cred_by_mech call . . . . . . . . . . . . . 40
   2.2:  Context-level calls . . . . . . . . . . . . . . . . . . . 41
   2.2.1:  GSS_Init_sec_context call . . . . . . . . . . . . . . . 42
   2.2.2:  GSS_Accept_sec_context call . . . . . . . . . . . . . . 49
   2.2.3:  GSS_Delete_sec_context call . . . . . . . . . . . . . . 53
   2.2.4:  GSS_Process_context_token call  . . . . . . . . . . . . 54
   2.2.5:  GSS_Context_time call . . . . . . . . . . . . . . . . . 55
   2.2.6:  GSS_Inquire_context call  . . . . . . . . . . . . . . . 56
   2.2.7:  GSS_Wrap_size_limit call  . . . . . . . . . . . . . . . 57